March 2013 - Roundtable

SpamAssassin false positives on DATE_IN_FUTURE_96_Q?
by Gilbert E. Detillieux 23 Feb '16

23 Feb '16

I mentioned this problem at the last round-table session, but didn't get a solution, so I thought I'd post it here, just in case anyone has any suggestions to offer. I'm still seeing a whole bunch of false positives in SpamAssassin, since an update was installed in mid-September on a CentOS 5.7 system, for a rule called DATE_IN_FUTURE_96_Q, which is only supposed to be triggered when the "Date:" header has a date that is 4 days to 4 month ahead of the date in the "Received" header that has the _smallest_ difference in date. Here are the headers from the latest e-mail I've received with this false-positive. (I've stripped out irrelevant headers, for the sake of clarity and simplicity.) From topfivestories(a)messagent.itworldcanada.com Mon Nov 14 07:50:13 2011 Received: from mail.messagent.itworldcanada.com (mail.messagent.itworldcanada.com [207.112.10.80]) by palladium.cs.umanitoba.ca (8.13.8/8.13.8) with SMTP id pAEDoAxV028594 for <gedetil(a)cs.umanitoba.ca>; Mon, 14 Nov 2011 07:50:12 -0600 Date: Mon, 14 Nov 2011 08:50:13 -0500 X-Spam-Status: No, score=-0.3 required=5.0 tests=BAYES_00,DATE_IN_FUTURE_96_Q, HTML_MESSAGE,RP_MATCHES_RCVD autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on palladium.cs.umanitoba.ca Note that I'm calling spamd via the spamass-milter on a system running sendmail. Note also, that in the above example, the only "Received" header was the one generated by my own server. (I've had other false positives, however, with multiple "Received" headers, all of which were within seconds of the time in the "Date" header.) Any ideas? -- Gilbert E. Detillieux E-mail: <gedetil(a)muug.mb.ca> Manitoba UNIX User Group Web: http://www.muug.mb.ca/ PO Box 130 St-Boniface Phone: (204)474-8161 Winnipeg MB CANADA R2H 3B4 Fax: (204)474-7609

6 11

Load-balancing / dual-WAN / multi-WAN routers or other solutions
by Hartmut W Sager 02 Apr '13

02 Apr '13

Now THIS should get a discussion going. What's the latest on load-balancing / dual-WAN / multi-WAN routers? I only see two kinds - some very old D-Link (DI-LB604) and Cisco (RV042, RV082, RV016) models, and quite a few current models from completely unheard of Oriental companies. My actual purpose would be failover redundancy (between my two Internets, namely MTS and Shaw) at least as much as, or more so, than load balancing, but there might as well be load balancing too, since both Internets are up almost all the time. I'm also somewhat interested in hearing about other related solutions (like a separate computer with multiple NIC's for multi-WAN, and special Linux, acting as a router) if no suitable router exists (or if such a router costs too much). Hmmm, Raspberry Pi just has one network port, right? Hartmut Sager

5 7

Summer project
by Mike Pfaiffer 31 Mar '13

31 Mar '13

Sorry if this is a little disjointed. I'm half asleep (which is usually when I get ideas - always a dangerous thing especially when I'm half asleep). ;-) Every summer the CLL at the Aboriginal Centre shuts down for the month of August. Normally I ask the owners of the parent company (a recycler) if I can borrow some equipment for both July and August so I can learn more about specific computer related things. Normally they are topics discussed here or at the MUUG meetings. I know it is only almost April but why wait until the last second... The owners (Alvin and Karen) usually like me to have some clear goals in mind when I propose a project. As a result I thought I'd bounce a few ideas off the pros and semi-pros here... Thanks to Rob D. I think I finally have my head wrapped around the concept of port forwarding. A couple of months ago he asked me to set up a Minecraft server for development purposes and so far things seem to work. My current physical assets are a D-Link 655 wireless router, and a (Debian) LAMP server running on a G4 server (which I should update soon), a USB "N" dongle which may or may not work, a Mac Mini which can connect to the router via the "G" protocol, and an external antenna for the router. Oh and I have those two Check Point wired routers. Chris H. says when the router is running the "N" protocol in the house the range is the edge of the property in the front and can not be picked up from the back. Inside the house was no problem. The router was located on the ground floor near the front of the house. The guys from the seniors radio club think it might be because of the stucco on the house. I could re-position the antenna to be in front of the front window. Anyhow the ideas I had were to try a bit more on the port forwarding thing by having second machine connected to the router and use the router as the main method of connecting to the services I am running. As before this would not be connected to the internet. The method I used last time was to connect to the IP of the LAMP server (eg. 192.168.X.Y instead of the router at 192.168.X.1 port 80). Then I'd try to extend the range to the back yard by using a second router at the back of the house. The second router would get the wireless signal from the first and repeat it. I'd like to know if there are any routers, custom built or out of the box, which will say transmit with the "G" AND "N" protocols as opposed to the "G" OR "N" protocols. The D-Link router will allow the first connection to determine subsequent connections. For example of the first connection is a "G" connection those wishing to connect with the "N" protocol only will not be able to do so. My temporary solution is to limit the router to "N" only. This means my Mac Mini can't connect since it doesn't support "N". With some fancy wiring I suppose I could use a couple of wireless routers together and have each do a different protocol. Since the Lab is switching the classroom to Windows 7 and half the machines are running cards which don't have new drivers (and don't work) I may be able to snag some "G" cards for testing under Linux. Are there any G/N cards people here would recommend to the parent company? I'm thinking if they are going to order a bunch they may as well order some spares (and I can use one for testing). So far I'm looking to request a PC (to run Ubuntu Server and Minecraft) and an "N" router. Maybe a couple of PCI NICs and another external antenna. Do folks here think my ideas are clear enough to bring to the owners? I had half a dozen more ideas when I started but forgot most of them when I turned on the computer. ;-) Is there anything more which would be worth checking out given I am a slow learner with a high level of frustration at the moment? Later Mike

4 12

determine IP address in linux
by Trevor Cordes 25 Mar '13

25 Mar '13

Seems simple. What's the best way (in a script) to get the IP address of an ethernet interface (in linux). For instance eth0. I used to have (perl, but also applies as a bash solution): $eip=`/sbin/ifconfig $int | grep 'inet addr' | awk '{print \$2}' | sed -e 's/.*://'` But the latest upgrade from F16 to F17 broke this (now the line contains "inet" but not "inet addr". So I started thinking of finding the most standardized way that (hopefully) won't change after a future kernel upgrade :-) It would seem that the less field parsing done, the better, as keywords and field position aren't guaranteed. Looks like ifconfig is now deprecated (according to man ifconfig). So now I'm doing: $eip=`ip -o -4 addr list eth0 | awk '{print \$4}'` That works now, but it still has a output format-dependent requirements. I looked for /sys or /dev files, but can't find any that have ip4 addr. I tried to find more options to whittle ip's output to give me just the address, no joy there. Ideas? PS: this is important as failures like this force me to drive out onsite to headless boxes, some of which are 200km away.

4 5

PPPoE/pppd dying
by Trevor Cordes 24 Mar '13

24 Mar '13

I have a script that starts/restarts PPPoE/pppd (MTS aDSL) as required on a box. It used to work A-OK. After updates w ehil back (probably from Fedora 14 -> 16 I think) a weird thing started happening: When my script is stopped (to be restarted after an update for instance), it instantly kills pppd and so my pppoe connection. pppd[1572]: Terminating on signal 15 pppd[1572]: Connect time 7.5 minutes. pppd[1572]: Sent 136980 bytes, received 76924 bytes. pppd[1572]: Connection terminated. pppoe[1573]: read (asyncReadFromPPP): Session 14782: Input/output error pppoe[1573]: Sent PADT pppd[1572]: Exit. sig 15 is SIGTERM. I can see before this happens that the processes involved are at the root owned by init (ps 1): root 4393 1 0 17:30 ? 00:00:00 /bin/bash /sbin/pppoe-connect /etc/sysconfig/network-scripts/ifcfg-ppp0 root 4417 4393 0 17:30 ? 00:00:00 /usr/sbin/pppd pty /usr/sbin/pppoe -p /var/run/pppoe-adsl.pid.pppoe -I eth0 -T 60 -U -m 1412 ipparam ppp0 linkname ppp0 noipdefault noauth default-asyncmap defaultroute hide-password nodetach mtu 1492 mru 1492 noaccomp nodeflate nopcomp novj novjccomp user thesuer lcp-echo-interval 20 lcp-echo-failure 3 nobody 4418 4417 0 17:30 ? 00:00:00 /usr/sbin/pppoe -p /var/run/pppoe-adsl.pid.pppoe -I eth0 -T 60 -U -m 1412 One would think that if it's been "daemonized" to be owned by init then killing the calling script would not affect it. But it is. What my script actually call is ifup and then Fedora's network magic in turn calls pppoe/pppd. ifup itself exits right after doing this (which is probably why its children become children of init). I tried adding a nohup before the ifup, but it doesn't help. I guess that makes sense since it's SIGTERM, not SIGHUP. I'm out of ideas to make sure this stuff stays up after restarting my script, and don't know what could have changed in Fedora to make this happen. Thanks!

1 0

snail mail spam ...
by Dan Keizer 22 Mar '13

22 Mar '13

Tried but true method I guess .. but .. did anyone else get postal mail from domain.com (co-sponsored by google)? it is regarding their ad-words. (usual, sign-up by x-date and receive y-$'s in return for spending z-$'s). Seems google wants to have companies with existing customer relationships to sell their adwords - several other companies are doing it with google too. No biggie if I already have some form of relationship with them... But, I have nothing to do with these 'domain.com' people - looks like they're just blasting out snail-mail to registered domain holders? Dan.

7 12

Another passing
by Mike Pfaiffer 21 Mar '13

21 Mar '13

Hamish has informed us about the passing of Lindsay Price yesterday afternoon. Before being seized by cancer, he was one of the semi-regular Mac guys attending meetings in the IBM building. Services will be held at the Assiniboia Christian Centre at 3390 Portage Avenue this Friday at 11:00am. Directions to get there are simple. Drive down Portage until arriving at Rouge Road. It will be on the South side. On the North side is a Safeway and McDonalds. Later Mike

2 3

Fwd: Best of Ebook Deal of the Day - Save 50% on the Top 25
by Gilbert E. Detillieux 19 Mar '13

19 Mar '13

FYI... ---------------------------------------- Save 50% - Top 25 ebooks (View in browser <http://post.oreilly.com/rd/9z1zsd7lm67kjnpukg4n0n345s8i2uklter53odj8j0>) O'Reilly Media Deal of the Day Best of Ebook Deal of the Day Get the top 25 ebooks for 50% off! Ebooks in Deal <http://post.oreilly.com/rd/9z1z894oadr7r71emo61lt11lvahpkdi2teu36h4iag> Every so often, we compile a list of our top-selling titles and bring them to your attention. From Data Visualization to Git to the Art of Hacking, these books have *impressed other readers*, and we think you'll like them, too. For one day only, you can get our best of "Ebook Deal of the Day" --- *the top 25 for 50% off*. Ebooks from oreilly.com <http://post.oreilly.com/rd/9z1zqiaeqm05i7kruorvdpf9fio1ddfsurfsc83rdk8> are *DRM-free*. You get *free lifetime access*, *multiple file formats*, and *free updates*. Sync with *Dropbox* --- your files, anywhere. View the Titles ? <http://post.oreilly.com/rd/9z1zak1omooid5ul0jqetmunleo2eemmb0vpjlrc1g0> Use discount code: DEAL This deal expires March 19, 2013 at 11:59pm PT and cannot be combined with other offers. Offer does not apply to Print, or "Print & Ebook" bundle pricing. Spreading the knowledge of innovators oreilly.com <http://post.oreilly.com/rd/9z1z496cgjt74cv1dv3uanjddq9rerkju48h860k4ko> You are receiving this message because you purchased directly from O'Reilly or registered titles. Keep up on all things O'Reilly by signing up for our *email alerts and newsletters* <http://post.oreilly.com/rd/9z1zvhs3hssf5onm2flrbuqugoo88iohjqtf8vijpo8>. To ensure delivery to your inbox (not bulk or junk folders), please add *oreilly(a)post.oreilly.com* <mailto:oreilly@post.oreilly.com> to your address book. To unsubscribe from all email announcements from O'Reilly, click here <http://post.oreilly.com/rd/9z1ze0bd053cuv0bt8dmvgdor9869ppvgjbuspr4dpo>. O'Reilly Media, Inc. 1005 Gravenstein Highway North, Sebastopol, CA 95472 (707) 827-7000

1 0

Re: [RndTbl] XDMCP on Ubuntu Precise (12.04 LTS)
by Adam Thompson 18 Mar '13

18 Mar '13

apt-get install tasksel man tasksel tasksel --something-like-list tasksel --something-like-install something-like-gnome Or just do apt-get install ubuntu-desktop, which gets you more than the minimum. -Adam Kevin McGregor <kevin.a.mcgregor(a)gmail.com> wrote: >_______________________________________________ >Roundtable mailing list >Roundtable(a)muug.mb.ca >http://www.muug.mb.ca/mailman/listinfo/roundtable

1 0

XDMCP on Ubuntu Precise (12.04 LTS)
by Kevin McGregor 18 Mar '13

18 Mar '13

I have a Ubuntu 12.04 LTS server with no GUI/desktop installed. I'd like to have a desktop of some kind running, but I won't be using the desktop at the console, just over my LAN. I'd like the console to remain text-only. What's the shortest route to getting this? I presume I'll need some kind of X client on my PC and connect via XDMCP to the server. Suggestions? Kevin

4 4